What the Koi, Prompt Security, Portkey and Aim deals mean for buyers

What happened?

• Palo Alto Networks and Koi: on 14 April 2026 Palo Alto Networks said it had completed the acquisition of Koi, with plans for a new Cortex XDR module and integration with Prisma AIRS, and said Koi would remain available as a standalone offering. koi.ai now redirects to the Cortex Agentic Endpoint Security page.
• Palo Alto Networks and Portkey: on 29 May 2026 Palo Alto Networks completed its acquisition of Portkey, an AI gateway, which becomes the gateway for Prisma AIRS. Earlier, on 23 March 2026, it announced Prisma AIRS 3.0 with agent discovery across cloud, SaaS and endpoints and an AI Agent Gateway in limited preview.
• SentinelOne and Prompt Security: on 5 August 2025 SentinelOne announced a definitive agreement to acquire Prompt Security for cash and stock. Prompt Security now brands itself as from SentinelOne and is described as built into the SentinelOne Singularity Platform. SentinelOne's blog post updated on 3 September 2025 is titled SentinelOne Acquires Prompt Security; we did not read a closing press release.
• Cato Networks and Aim Security: Cato Networks' press release of 3 September 2025 says it acquired Aim Security. Aim's pages focus on discovering GenAI apps and protecting data in public AI tools and enterprise copilots; we found no detail on device-level agent control.
• Akamai and LayerX: Akamai's product page is titled Akamai Workforce Protector (Formerly LayerX) and says LayerX is now Workforce Protector following Akamai's acquisition; the page does not give the acquisition date.

What about the companies that remain on their own?

Several of them raised large rounds in 2026, by their own announcements. Onyx Security came out of stealth on 12 March 2026 citing $40 million from Conviction Partners and Cyberstarts, then announced a $113M Series B led by Bessemer Venture Partners on 29 July. Zenity announced a $125 million Series C led by Norwest on 3 August. Bloom Security published its launch post on 30 July, and Ctech reported a $20 million seed round for it the same day. Lasso Security's newsroom lists a $30 million round led by ClearSky with Entrée Capital in September 2026. Noma Security announced a $100M Series B led by Evolution Equity Partners on 31 July 2025. Bay and Harmonic Security did not announce funding in our sources for this period.

What do the deals change for buyers?

The main change is the build-on-what-you-have option. A company that already runs Cortex XDR can add Koi as a module rather than buy a separate product; a SentinelOne customer can look at Prompt Security inside Singularity. The finder reflects this: picking Palo Alto Networks or SentinelOne in the stack question gives the built-in product four extra points.

That option is attractive for procurement and operations: one vendor, one console, one contract. It is not automatically the closest fit. In our example Palo Alto Networks profile, Koi comes first, with Bay and Lasso Security next because their pages describe more of the checks the profile triggers, such as tool-call decisions. In our SentinelOne profile, Prompt Security comes first and Bay second. A buyer who weighs those checks more heavily than a single console may still prefer the second group.

What should buyers watch for?

• Page lag. Acquired products' public pages often describe the product as it was before the deal, or describe the plan rather than what ships. Ask what is available today in the module you would buy.
• Standalone versus module. Koi remains available standalone; ask whether features differ between the standalone product and the platform module.
• Roadmap claims. Integration plans, such as Koi with Prisma AIRS, are plans until they ship.
• Gateways versus endpoints. Palo Alto Networks now has both an endpoint product (Koi) and a gateway (Portkey, in Prisma AIRS). They see different things; check which one your use case needs.

How does the finder treat acquired products?

Exactly like the others. Each product's facts come from its own pages, the owner is shown on its notes, and the built-into-your-platform bonus applies only when you say you run that platform. The limitations section of how the finder works notes that pages for acquired products may lag the product.

Will there be more deals?

We do not predict deals, and nothing in our sources says which companies might be next. What buyers can do is plan for change. Prefer contracts that let you leave if a product is folded into a platform you do not run, ask each vendor what happens to standalone customers after an acquisition, and keep your own record of AI agents, MCP servers and rules in a form you can export. Koi's case is a useful reference point: Palo Alto Networks said it would remain available as a standalone offering, which is the question to ask any acquired vendor in writing.